Quantum key distribution with higher-order alphabets using spatially-encoded qudits 
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We present a proof of principle demonstration of a quantum key distribution scheme in higher- 
order d-dimensional alphabets using spatial degrees of freedom of photons. Our implementation 
allows for the transmission of 4.56 bits per sifted photon, while providing improved security: an 
intercept-resend attack on all photons would induce an average error rate of 0.47. Using our system, 
it should be possible to send more than a byte of information per sifted photon. 
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Though quantum key distribution (QKD) has become 
a commercial reality 1] , there is still much interest in fun- 
damental research. One topic of fundamental importance 
is the design of protocols and implementations which in- 
crease the bit transmission rate and/or the security of 
the QKD scheme. It has been pointed out recently that 
one can achieve both of these objectives by increasing the 
dimensionality of the system, that is, encoding a random 
key string in d-dimensional qudits instead of the usual 
binary qubits 0, Q • 

It is straightforward to generalize the well-known BB84 
protocol |5j to qudits |2| y. L|. for which it is possible 
to send on average log 2 d bits per sifted qudit. Higher- 
dimensional qudits are advantageous not only for an in- 
creased bit transmission rate, but also increased security. 
An eavesdropper employing an intercept-resend strategy 
would induce a qudit error rate of Ed — \^^^ since 
half the time she measures in the wrong basis, and con- 
sequently sends the wrong state with a probability of 

(d-i)/dSa. 

Experimentally, there are several methods of encoding 
d-dimensional qudits in photons, including time-bin U 
orbital angular momentum |6j, the polarization state of 
more than one photon , and more recentlyposition and 
linear momentum of entangled photons • 

Here we provide an experimental demonstration 
of quantum key distribution using higher-order d- 
dimensional alphabets encoded in the transverse spatial 
profile of single photons. Our scheme is based on the 
standard BB84 protocol , in which Alice chooses which 
state to send based on the value of a random bit oi, while 
her choice of basis is selected using random bit a 2 . A two- 
basis BB84 protocol using qudits works the same way 
0,0, however, Alice sends states according to the value 
of a random d-level "dit" . A simple illustration of our 
scheme is shown in FIG.^ Let us first discuss the choice 
of basis. In our scheme, Alice (A) and Bob (B) encode 
(Alice) and decode (Bob) information in the transverse 
profile of single photons by choosing randomly between 
optical imaging systems and optical Fourier transform 
systems. In order to avoid the quadratic phase factors 
that generally appear in an imaging system |icj . it is 
necessary to use a telescopic lens system, consisting of 
two confocal lenses. This is equivalent to applying the 
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FIG. 1: Illustration of QKD using imaging (J) and Fourier 
(F) optical systems. 



Fourier transform operation twice, so that, as part of the 
protocol, Alice and Bob will each choose randomly be- 
tween a single or double Fourier transform lens system. 
For simplicity, let us assume that Alice and Bob use iden- 
tical imaging systems, consisting of two lenses with focal 
length /, as well as identical Fourier systems consisting of 
a single lens with focal length 2/. The "quantum chan- 
nel" consists of a telescopic lens system consisting of two 
lenses with focal length f c which transmits Alice's output 
to Bob's input. 

In the following we will assume that the input field is a 
single photon state, which in the paraxial approximation 
can be described by 



«(q) |q) dq, 



where v(q) is the angular spectrum defined by 
«(q) = J W{p,Q)e-^ p dp, 



(1) 



(2) 



and W(p, 0) is the input field at z = (plane P/Un). 
Here q is the transverse component of the wave vector 
and p is the transverse position coordinate. The de- 
tection probability in plane Pb for a given combination 
of lens configurations is given by V a f3{p) — \A a fi{p)\ 2 , 
where A(p) — (vac| E^ /3 (p) is the detection ampli- 
tude, E^^fo) is the field operator for the entire lens sys- 
tem |l2j, and a, = I,F denotes either imaging or 
Fourier configurations. For a series of n confocal lenses, 
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^ap(p) simplifies to 

E a/» =£ Jdqjdq, - - J dq n a(q n y q p x 



(3) 



where £ is a constant, k is the magnitude of the wavevec- 
tor, fj is the focal length of the j th lens and a(q) is the 
usual destruction operator. For the four possible lens 
systems illustrated in FIG. the detection amplitudes 
are 
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In our scheme, Alice encodes information into the in- 
put field by positioning an aperture A(p — pd) in plane 
Paiu, such that each aperture position pd corresponds 
to a character in the rf-dimensional alphabet. Assuming 
that the incident field is a plane wave, the input field is 
equivalent to the aperture function: W(p, 0) = A(p—pd). 
Eqs. Q and (JSJ show that when Alice and Bob choose 
the same lens configuration, Bob's detection amplitudes 
will reproduce the aperture function, and Bob should de- 
code the correct character. For complementary lens con- 
figurations the detection amplitudes are given by Eqs. 
© and (JJJ, and are proportional to the Fourier trans- 
form of the aperture. A well known property of the 
Fourier transform is that a shift in position space man- 
ifests as a phase in the Fourier transform (J 7 ) space: 
T[A{p - p d )} = exp{ikp Pd /2f) x T[A{p)\. Thus the 
detection probabilities Vif and Vfi contain no informa- 
tion concerning the aperture position pd- Even though 
Alice and Bob discard these results as part of the BB84 
protocol, it is important that no information is available, 
as this guarantees that an eavesdropper cannot obtain in- 
formation without causing an increase in the error rate. 

FIG. El shows the setup for an experimental demon- 
stration of QKD using spatially encoded qudits. As is 
common in most QKD implementations, our experiment 
was performed with an attenuated laser beam, which, 
though there are zero- and multi-photon terms present, 
can be used to approximate a single photon state |l3| . 
The attenuated beam from a Coherent Verdi V5 laser 



FIG. 2: Experimental setup. 



(514 nm) was expanded by a factor of 4 using a beam 
expander consisting of 25 mm and 100 mm focal length 
lenses. Information was encoded into the spatial pro- 
file by positioning a 200 /mi pinhole in Alice's transverse 
plane Paui- The pinhole was mounted on a manual x — y 
translation stage, though in principle a randomly-driven 
mechanical device could be used. In order to implement 
both imaging and Fourier configurations, we constructed 
a Mach-Zehnder interferometer using 50-50 beam split- 
ters (BS), in which one arm contained a telescopic imag- 
ing system (/ = 100mm), while the other contained a 
200 mm focal length lens in a Fourier configuration. To 
switch between imaging and Fourier configurations, we 
toggled manually between the two arms of the interfer- 
ometer. As interference is not actually used in the QKD 
scheme, the interferometer functions merely as a router. 
However, the interference is useful for initial alignment. 
Pinholes were placed in the focal planes of the imaging 
and Fourier lenses in order to filter higher spatial fre- 
quencies. As a result, the aperture function A(p — pd) 
can be approximated by a Gaussian. The quantum chan- 
nel consisted of a telescopic lens system (f c = 150 mm). 

Using a BS, Bob chose randomly between imaging 
and Fourier systems. His optical systems were identical 
to Alice's. One single photon detector (equipped with 
200/im diameter circular detection aperture and ~ 250 
nm bandwidth filter) was scanned throughout the Fourier 
detection plane, and one throughout the image detec- 
tion plane. Ideally, the detection system would consist 
of either two-dimensional multi-detector arrays, or CCD 
cameras with single- photon sensitivity |l4j |. 

The dimension d of Alice and Bob' s alphabet is deter- 
mined by the size of the aperture A(p) and its Fourier 
transform. Alice and Bob must decide on the best way to 
define positions in transverse planes PAin (Alice's aper- 
ture) and Pb (Bob's detector) that will correspond to 
the characters in their alphabet. To use the area avail- 
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FIG. 3: Intensity distributions at Bob's detection plane for 
the four lens configurations //, IF, FI and FF for the case 
when Alice sends the character "7" . Here lighter squares cor- 
respond to a larger number of photo-counts. 



able in the most efficient manner, we chose to approxi- 
mate Alice's circular aperture and Bob's circular detec- 
tion aperture with a hexagon (center to vertex distance 
200/im). Using this method, we were able to work with 
a 37-dimensional ( "septrigesimal" ) alphabet. Alice and 
Bob's encoding/decoding scheme is shown at the bottom 
of FIG. [5] The circle corresponds to the area containing 
99% of the large Gaussian profile obtained using comple- 
mentary IF or FI configurations. 

FIG. |3] shows the intensity pattern at Bob's detection 
plane for the four possible lens configurations when Alice 
sends the character "7" . The distributions were obtained 
by placing the detector at each of the pre-defined detec- 
tion positions, so that each of the 37 squares in the figures 
correspond to a character in the alphabet. For II and 
FF configurations, Bob detects the character "7" with 
high probability, while for IF and FI configurations, he 
obtains a widened (Gaussian) distribution, which pro- 
vides little information about the character Alice sent. 

As a better visualization of our results, FIG.'sE]and[S] 
show probability distributions as a function of each char- 
acter for Bob's Fourier and image detection systems, re- 
spectively. In both FIG.'s, Alice has sent the characters 
"4", "7", "G", "H" , "P" and "Z". When Bob uses the 
same lens configuration as Alice (left side in both figures) , 
he detects the correct character with a high probability. 

0.06 - 0.11 for the FF 
0.10 - 0.19 for II configura- 
tion. Roughly 25% of the error was due to photo-counts 
caused by unwanted ambient light and dark counts (~ 
200 counts/sec), while the rest is due to misalignment 
and erroneous counts due to the hexagon pattern. Using 
narrow band interference filters and detectors with a re- 
duced dark count rate (~ 25-50 counts/sec), we estimate 
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FIG. 4: Normalized counts for Bob's Fourier (F) detection 
system when Alice uses Fourier (left) and Image (right) en- 
coding. 
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FIG. 5: Normalized counts for Bob's Image (J) detection 
system when Alice uses Image (left) and Fourier (right) en- 
coding. 



that the error rates could easily be reduced to about 5 
- 15%. Further methods to reduce the II and FF error 
rate involve "decoy" alphabet states and will be discussed 
elsewhere |l2^ . 

FIG.'s 0] and [5] also show the results when Alice and 
Bob use conjugate IF or FI configurations, from which 
it can be seen that the detection probabilities Vif and 
Vfi are the approximately the same for all character's 
sent by Alice. We note that Bob's detection positions 
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were defined according to the two-dimensional detection 
scheme shown in FIG. |21 so the several peaks shown in 
the IF and FI patterns are actually slices of a 3D Gaus- 
sian distribution. There is a difference between our QKD 
implementation and others: the detection probabilities 
for complementary measurements are not constant for 
all states: Vif = Vfi 7^ 1/d and thus the sifted key is 
not completely random. However, after sifting, Alice and 
Bob can discard some of their results in order to obtain 
a completely random key string. 

In order to minimize Eve's information, Alice should 
choose characters based on the distributions Vif and 
Vfi- Suppose that Alice sends each character k with 
probability Pk, obtained by averaging the IF and FI 
detection results. The amount of information that can 
be sent from Alice to Bob is given by the Shannon infor- 
mation [ijl. which in our case is 

d—l 

jAB = jA + Pk (l - £ k ) l 0g2 (l - £ k ) 
k=0 

, ST^ Pk&kPj , £kPj / n 

fe=0i=0,j#fe 

where £^ is the error probability and I A = 
— X)fc=o P k 1°S2 Pk = 4.56 bits/photon is the information 
transmission in the absence of errors. Our experimen- 
tal error rates T> n and D FF varied between 0.06 and 
0.19, giving 3.00 < I AB < 3.96 bits/photon. For an 
intercept-resend attack on a fraction 77 of the photons, 
the error rate is £ k = ^(1 — P k ), which varies between 
0.450?y and 0.499?7. In this case, Eve's information is 
given by I E = -\ Yl=l Pk log 2 P k = 2.2877 bits/photon. 
In order to employ classical error correction and pri- 
vacy amplification, it is necessary that I AB > I E |13| . 
I AB = I E = 1.858 bits/photon occurs when the average 
error rate £ = J^k Pk£k is about 0.38, much larger than 
our values of 0.06 — 0.19. We note that the allowable error 
rate for cloning-based individual attacks on a two-basis 
d = 37 protocol is 0.420 0. 

Let us briefly discuss an important security issue par- 
ticular to this implementation. A more detailed security 
analysis will be provided elsewhere [l^ . In order for the 
transmission to be secure, an eavesdropper Eve should 
not be able to determine when Alice is using the imaging 
or Fourier system to encode information. If there ex- 
ist detection positions at which Eve can detect photons 
that probably correspond to an I-F or F-I (Alice-Eve) 
configuration, then she can deduce that she measured in 
the wrong basis, and choose not to resend the photon. 
Eve's presence would then be marked only as the loss of 
a photon, and not a registered error. In order to avoid 
this situation, Alice and Bob must define their alphabet 
so that every detection position with a nonzero IF or 
FI detection probability also has a nonzero II or FF 
detection probability. In this fashion, Eve cannot deduce 



whether she is measuring in the same basis as Alice or 
not. On the other hand, if Eve can deduce that she prob- 
ably measured in the correct basis, she gains nothing by 
not sending the photon. Of course she has gained infor- 
mation and left no disturbance, but Alice and Bob can 
minimize these cases by removing these characters from 
the final sifted key string, at the cost of a reduction in 
the size d of the alphabet. 

We have presented a proof of principle demonstration 
of QKD using spatially encoded qudits. Generalization 
of our scheme to even larger dimensions is straightfor- 
ward. Using an even smaller aperture, it should be pos- 
sible to encode an extremely large amount of information, 
increasing both the transmission rate as well as the se- 
curity of the QKD protocol. For example, using a 60/im 
pinhole, should give an alphabet of roughly 400 charac- 
ters in each photon, resulting in a transmission capacity 
of more than 1 byte per sifted photon. In terms of a real- 
world application, QKD based on spatial qudits seems 
best suited for free-space transmission as opposed to op- 
tical fibers. In a free-space setup, disturbances in the 
wavefront due to propagation through the atmosphere 
might be monitored using a reference beam, and then 
corrected. 
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